Google Chrome CVE-2026-106411

Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (any version prior to 155.0.8059.39) - this maps to UI:R (user must visit/open the crafted page) with no authentication or special configuration otherwise needed, so default Chrome installations are affected. The key LIMITING factors are: (1) required user interaction (victim must navigate to the malicious page), and (2) code execution is contained WITHIN the renderer sandbox, so this bug alone does not escape to the host OS and would need chaining with a separate sandbox-escape for full compromise. No non-default feature or setting is required to trigger the parser use-after-free.

This is a credible, actionable priority despite the absence of exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated memory-corruption bug (CWE-416 use-after-free in the HTML parser) requiring only that a victim visit a crafted page - the classic drive-by profile for browser RCE. However, the signals are mixed on urgency: CISA SSVC lists Exploitation as 'none' (no observed or public exploitation), no KEV listing is present, no EPSS score was provided, and no POC is referenced, so this is currently 'no public exploit identified at time of analysis' rather than active exploitation. Critically, the description states code execution occurs 'inside the sandbox,' meaning this single bug yields control of the renderer process only and would need to be chained with a sandbox-escape to achieve full host compromise - the raw 8.8 and C:H/I:H/A:H overstate standalone real-world impact. SSVC Technical Impact of 'total' reflects total control of the affected (renderer) component, consistent with scope-unchanged (S:U). Net: patch promptly given Chrome's ubiquity and the ease of parser-UAF weaponization, but treat it as high (not emergency) in the absence of exploitation evidence and given the sandbox containment.

An attacker hosts or compromises a web page containing malformed HTML that triggers the use-after-free in Chrome's parser; a victim who merely browses to the page (UI:R, no authentication) has freed memory reclaimed and attacker-controlled, yielding arbitrary code execution within the renderer sandbox. No public POC or exploit is identified at time of analysis, and realistic full-host compromise would require chaining this with a separate sandbox escape.